Afternoon Review in IT Security — October 2, 2026

Today's threat landscape reflects persistent nation-state activity targeting critical infrastructure, urgent zero-day exploitation in enterprise email systems, and notable law enforcement action against state-sponsored actors. Organizations face mounting pressure to patch vulnerabilities and strengthen defenses against sophisticated adversaries.

Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks

The China-based hacking group Warlock has significantly expanded its exploitation campaigns targeting SharePoint vulnerabilities across critical infrastructure sectors. The group has been actively exploiting these vulnerabilities since July 2025, demonstrating sustained focus on high-value targets. Security researchers have identified six critical vulnerabilities being leveraged in these attacks, including CVE-2026-32201, CVE-2026-45659, CVE-2026-50522, CVE-2026-55040, CVE-2026-56164, and CVE-2026-58644. The campaign underscores the persistent threat posed by nation-state actors to organizations running unpatched SharePoint instances. Source: Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks

Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action

A critical zero-day vulnerability in Fortinet FortiMail has been actively exploited in the wild, demanding immediate attention from affected organizations. CVE-2026-104286 is classified as critical severity and represents a path traversal vulnerability that could allow attackers to write arbitrary files to compromised systems. The fact that exploitation is occurring before patches are widely available presents an elevated risk window for enterprises relying on FortiMail for email security. Organizations should prioritize assessment and remediation of this vulnerability across their infrastructure. Source: Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action

In Rare Move, Alleged Iranian State Hacker Extradited to US

In a significant development in international cybersecurity law enforcement, Amir Barati, an alleged member of the Mabna Institute, has been extradited to the United States. Barati was indicted for targeting universities, private organizations, and government entities across the US and internationally. This extradition represents a rare instance of successful prosecution of a state-linked threat actor and signals increased coordination among international law enforcement agencies in combating nation-state cyber operations. The case highlights the long-term commitment to holding state-sponsored actors accountable for their cyber campaigns. Source: In Rare Move, Alleged Iranian State Hacker Extradited to US

A Flaw in ChatGPT's Mac App Could Have Let Hackers Grab Sensitive Data

While artificial intelligence tools continue to advance rapidly, a recently patched vulnerability in OpenAI's ChatGPT macOS application demonstrates that AI software itself presents an attractive target for threat actors. The flaw could have enabled attackers to access sensitive user data including chat logs and browser session information. This vulnerability serves as a reminder that as organizations adopt AI-powered tools for productivity and analysis, these applications must undergo rigorous security assessment and patching protocols. The incident highlights the need for security awareness around emerging software categories that may receive less scrutiny than traditional enterprise applications. Source: A Flaw in ChatGPT's Mac App Could Have Let Hackers Grab Sensitive Data

The convergence of nation-state activity, critical infrastructure targeting, and zero-day exploitation underscores the importance of maintaining rigorous patch management and vulnerability assessment programs across all organizational systems and applications.